Document the release process

[SteveLasker]

What is the areas you would like to add the new feature to?

Go-COSE Library

Is your feature request related to a problem?

We are currently working out of main, where all approved/merged updates are pushed to main.
As a new release is queued, we stabilize out of main. This has served us well thus far.
Open question:

• Do we anticipate stabilizing a release, while developing a new version concurrently? This may require a more complex branching strategy.
• Do we believe we can work around our stabilize in main process?

Either way, we should document the current working process.

[OR13]

This is blocking the next minor release... and fixes to :

• test failures in Debian: TestSignature_Sign_Internal and TestSignature_toBeSigned #181

[OR13]

I recall based on our previous meeting, we said our policy should be:

Release Policies
- Folders for release polices
- Minor releases are reviewed by maintainers
- Major release follows the same policies as minor
- We may do a third party audit, and would require it to be published before the release
- We reserve the right to not do the audit, if the maintainers believe the costs of the audit aren't justified based on the capabilities added or bugs fixed.